ever heard of ActiveX? you know, arbitrary code installing and running in your browser and available to be scripted by javascript? sorry. I'm not solely responsible, there were many of us. but still sorry, pretty responsible. we were young. code-signing as a means of validating origin was a great idea. it needed additional infrastructure to keep track of originators and to prevent abuse, though, and that wasn't perfectly thought through or executed. live and learn.